Azure应用网关创建Private Endpoint报错，需调整哪段代码？

DevOps 小满

2026-6-17

问题

尝试在Azure环境中为Application Gateway创建Private Endpoint时，尽管私用链接已存在且处于“Succeeded”状态，仍持续收到以下错误：

ERROR: (ApplicationGatewayPrivateLinkOperationError) 调用Microsoft.Network/applicationGateways失败。错误消息：无法对Application Gateway /subscriptions/26d8a9f9../resourceGroups/rg-dev-new-test5/providers/Microsoft.Network/applicationGateways/app-gateway-dev执行私用链接操作。请确保应用网关已配置私用链接。
代码：ApplicationGatewayPrivateLinkOperationError 消息：调用Microsoft.Network/applicationGateways失败。错误消息：无法对Application Gateway /subscriptions/26d8a9f9../resourceGroups/rg-dev-new-test5/providers/Microsoft.Network/applicationGateways/app-gateway-dev执行私用链接操作。请确保应用网关已配置私用链接。

已执行步骤：

创建带有Application Gateway专用子网的Virtual Network。
为Application Gateway创建Public IP。
创建WAF Policy并关联到Application Gateway。
成功部署带有WAF_v2 SKU的Application Gateway。
尝试创建Private Endpoint。

复现问题的bash脚本：

#!/bin/bash
set -e
export MSYS_NO_PATHCONV=1

# Configurations
LOCATION="westeurope"
RG="rg-dev-new-test5"
VNET="vnet-ai-services-dev"
ADDR="10.0.0.0/16"
APPGW_SUBNET="app-gateway-subnet-dev"
APPGW_PREFIX="10.0.2.0/24"
PE_SUBNET="private-endpoint-subnet-dev"
PE_PREFIX="10.0.9.0/24"
APPGW="app-gateway-dev"
WAF="waf-policy-dev"
PIP="appgw-public-ip"
PRIVATE_LINK_CONFIG="appgw-private-link-config"
SUB_ID=$(az account show --query id -o tsv)

# Create Resource Group
az group create -n $RG -l $LOCATION

# Create Virtual Network with Application Gateway subnet
az network vnet create -g $RG -n $VNET --address-prefix $ADDR \
  --subnet-name $APPGW_SUBNET --subnet-prefix $APPGW_PREFIX

# Create Private Endpoint subnet
az network vnet subnet create -g $RG --vnet-name $VNET -n $PE_SUBNET \
  --address-prefixes $PE_PREFIX --disable-private-link-service-network-policies true

# Create Public IP for Application Gateway
az network public-ip create -g $RG -n $PIP --sku Standard --allocation-method Static

# Create WAF Policy
az network application-gateway waf-policy create -g $RG -n $WAF -l $LOCATION

# Construct WAF Policy ID
WAF_ID="/subscriptions/$SUB_ID/resourceGroups/$RG/providers/Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies/$WAF"

# Create Application Gateway with WAF_v2 SKU and Priority
az network application-gateway create -n $APPGW -g $RG -l $LOCATION \
  --capacity 2 --sku WAF_v2 --vnet-name $VNET --subnet $APPGW_SUBNET \
  --public-ip-address $PIP --frontend-port 80 --http-settings-port 80 \
  --http-settings-protocol Http --routing-rule-type Basic --waf-policy $WAF_ID \
  --priority 100

# Get Application Gateway Frontend IP Configuration Name
FRONTEND_IP_NAME=$(az network application-gateway frontend-ip list  --gateway-name $APPGW --resource-group $RG  --query "[0].name"  -o tsv)

# Add Private Link Configuration to Application Gateway
az network application-gateway private-link add \
  --resource-group $RG \
  --gateway-name $APPGW \
  --name $PRIVATE_LINK_CONFIG \
  --frontend-ip $FRONTEND_IP_NAME \
  --subnet "/subscriptions/$SUB_ID/resourceGroups/$RG/providers/Microsoft.Network/virtualNetworks/$VNET/subnets/$PE_SUBNET"

# Get Private Link Configuration ID
PRIVATE_LINK_CONFIG_ID=$(az network application-gateway private-link show \
  --resource-group $RG \
  --gateway-name $APPGW \
  --name $PRIVATE_LINK_CONFIG \
  --query id -o tsv)

# Get Application Gateway ID
APPGW_ID=$(az network application-gateway show -n $APPGW -g $RG --query id -o tsv)

# Attempt to create Private Endpoint (expected to succeed if supported)
az network private-endpoint create -n "appgw-pe" -g $RG --vnet-name $VNET \
  --subnet $PE_SUBNET \
  --private-connection-resource-id $APPGW_ID \
  --group-id "gateway" \
  --connection-name "appgw-pec" \
  --location $LOCATION

解决方案

问题核心是创建Private Endpoint时，--private-connection-resource-id参数指向的资源错误：Azure要求Private Endpoint直接关联到Application Gateway的Private Link配置资源，而非网关实例本身。

需要调整脚本中创建Private Endpoint的代码段，将--private-connection-resource-id的值从$APPGW_ID替换为$PRIVATE_LINK_CONFIG_ID，同时保留--group-id "gateway"不变。

修改后的创建Private Endpoint命令如下：

# 创建Private Endpoint（修正后）
az network private-endpoint create -n "appgw-pe" -g $RG --vnet-name $VNET \
  --subnet $PE_SUBNET \
  --private-connection-resource-id $PRIVATE_LINK_CONFIG_ID \
  --group-id "gateway" \
  --connection-name "appgw-pec" \
  --location $LOCATION

额外建议：在获取PRIVATE_LINK_CONFIG_ID之后添加一段等待时间，确保Azure资源状态同步完成，避免因配置未完全生效导致的错误：

# 等待Private Link配置生效
sleep 30

内容的提问来源于stack exchange，提问作者John